7cfd5c32281454f146c295e9c6ca74df7f92097162bc11a83e72b5382606a93a

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7cfd5c32281454f146c295e9c6ca74df7f92097162bc11a83e72b5382606a93a.exe
Size 519KB
Sample260702-yfjmxadv41
SHA256 7cfd5c32281454f146c295e9c6ca74df7f92097162bc11a83e72b5382606a93a
MD5 2373536fdfa8936625901f3d550d00d4
SHA1 8ab72042eecc156fc0ddf2dc2b0768175e1ffc26
SHA512 a59bedf50ac6eb2be0851e94e1b47084259d75d7c95e326eadb0a7383994b978a44dee6469ef4e209c3157b8c5378c3c26c8ce8560e4d14b52da5fa463824d22
SSDEEP 6144:VQtK91cFMoiTEYd/pLeIUfVLyOuQFJirncEOkCybEaQRXr9HNdvOa:V39OFaX/pKIUfVLyOYvOkx2LIa
TLSH
T1CCB46D2AFAA08077C4B79574C4A396A6FBB1742127204BCFA3A4475A1F637D2BD3530D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5168-0-0x00000000008C0000-0x000000000094A000-memory.dmp	upx
behavioral2/memory/5168-1-0x00000000008C0000-0x000000000094A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5796	5168	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7cfd5c32281454f146c295e9c6ca74df7f92097162bc11a83e72b5382606a93a.exe

C:\Users\Admin\AppData\Local\Temp\7cfd5c32281454f146c295e9c6ca74df7f92097162bc11a83e72b5382606a93a.exe
"C:\Users\Admin\AppData\Local\Temp\7cfd5c32281454f146c295e9c6ca74df7f92097162bc11a83e72b5382606a93a.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5168 -s 472
  2⤵
  - Program crash
  PID:5796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5168 -ip 5168
1⤵
PID:5808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5168-0-0x00000000008C0000-0x000000000094A000-memory.dmp

Download

memory/5168-1-0x00000000008C0000-0x000000000094A000-memory.dmp